feat(email): PWA login sends code only; drop admin link from alert emails

Two email changes, per the owner:

1. Code-only login from an installed PWA. A login requested while running as a
   standalone PWA now omits the one-tap confirm link from the email — the link
   would open in a separate browser whose minted session cannot reach the PWA,
   stranding the login. The code is typed in the same window instead. The client
   sends a `pwa` flag (isStandalone) on the email-code request (a new FBS field,
   threaded through the gateway); the backend omits the deeplink when it is set,
   reusing the existing deletion-code link-omission path. Non-PWA browser logins
   keep the one-tap link. No polling, no migration.

2. Security: the operator alert digest no longer embeds the admin-console (/_gm)
   URL. An admin link must never travel in an email, where a mail provider could
   cache or index it; the operator opens the console directly.

Tests: an inttest asserting the PWA login email omits the link (and a browser one
keeps it); a codec round-trip of the new pwa field; the alert-digest test flipped
to guard the admin link is absent. Docs: ARCHITECTURE + FUNCTIONAL (+ru).

ui/src/lib/app.svelte.ts

@@ -35,6 +35,7 @@ import {
 } from './telegram';
 import { onVKPath, insideVK, vkInit, vkClose, vkDisableSwipeBack, vkLaunchParams, vkUserName, vkStartParam, vkOnScheme, vkOnInsets, vkSetViewSettings, appearanceForBg } from './vk';
 import { pendingVKLink, type VKLinkCallback } from './vkid';
+import { isStandalone } from './pwa';
 import { registerServiceWorker } from './pwa.svelte';
 import { haptic } from './haptics';
 import { CLOUD_PREFS_KEY, decodeClientPrefs, encodeClientPrefs } from './cloudprefs';
@@ -980,7 +981,7 @@ export async function loginGuest(): Promise<void> {
 
 export async function requestEmailCode(email: string): Promise<boolean> {
   try {
-    await gateway.authEmailRequest(email, app.locale);
+    await gateway.authEmailRequest(email, app.locale, isStandalone());
     return true;
   } catch (err) {
     handleError(err);

ui/src/lib/client.ts

@@ -65,7 +65,7 @@ export interface GatewayClient {
    *  cosmetic seed for a brand-new account). */
   authVK(params: string, displayName: string): Promise<Session>;
   authGuest(locale?: string): Promise<Session>;
-  authEmailRequest(email: string, language: string): Promise<void>;
+  authEmailRequest(email: string, language: string, pwa: boolean): Promise<void>;
   authEmailLogin(email: string, code: string): Promise<Session>;
   /** Confirm a one-tap email deeplink token: a login returns a session to adopt; a
    *  link returns a status ('confirmed' | 'merge_required'). */

ui/src/lib/codec.test.ts

@@ -122,10 +122,11 @@ describe('codec', () => {
     expect(guest.browserTz()).toBe('-05:30');
 
     const email = fb.EmailRequestRequest.getRootAsEmailRequestRequest(
-      new ByteBuffer(encodeEmailRequest('a@example.com', '+00:00', 'en')),
+      new ByteBuffer(encodeEmailRequest('a@example.com', '+00:00', 'en', true)),
     );
     expect(email.email()).toBe('a@example.com');
     expect(email.browserTz()).toBe('+00:00');
+    expect(email.pwa()).toBe(true);
     expect(email.language()).toBe('en');
 
     const confirm = fb.EmailConfirmLinkRequest.getRootAsEmailConfirmLinkRequest(

ui/src/lib/codec.ts

@@ -214,7 +214,12 @@ export function encodeGuestLogin(locale: string, browserTz: string): Uint8Array
   return finish(b, fb.GuestLoginRequest.endGuestLoginRequest(b));
 }
 
-export function encodeEmailRequest(email: string, browserTz: string, language: string): Uint8Array {
+export function encodeEmailRequest(
+  email: string,
+  browserTz: string,
+  language: string,
+  pwa: boolean,
+): Uint8Array {
   const b = new Builder(128);
   const e = b.createString(email);
   const tz = b.createString(browserTz);
@@ -223,6 +228,7 @@ export function encodeEmailRequest(email: string, browserTz: string, language: s
   fb.EmailRequestRequest.addEmail(b, e);
   fb.EmailRequestRequest.addBrowserTz(b, tz);
   fb.EmailRequestRequest.addLanguage(b, l);
+  fb.EmailRequestRequest.addPwa(b, pwa);
   return finish(b, fb.EmailRequestRequest.endEmailRequestRequest(b));
 }
 

ui/src/lib/mock/client.ts

@@ -150,7 +150,7 @@ export class MockGateway implements GatewayClient {
   async authGuest(): Promise<Session> {
     return { ...SESSION };
   }
-  async authEmailRequest(_email: string, _language: string): Promise<void> {}
+  async authEmailRequest(_email: string, _language: string, _pwa: boolean): Promise<void> {}
   async confirmEmailLink(_token: string): Promise<ConfirmLinkResult> {
     return { purpose: 'link', status: 'confirmed', session: null };
   }

ui/src/lib/transport.ts

@@ -118,8 +118,8 @@ export function createTransport(baseUrl: string): GatewayClient {
     async authGuest(locale) {
       return codec.decodeSession(await exec('auth.guest', codec.encodeGuestLogin(locale ?? '', browserOffset())));
     },
-    async authEmailRequest(email, language) {
-      await exec('auth.email.request', codec.encodeEmailRequest(email, browserOffset(), language));
+    async authEmailRequest(email, language, pwa) {
+      await exec('auth.email.request', codec.encodeEmailRequest(email, browserOffset(), language, pwa));
     },
     async confirmEmailLink(token) {
       return codec.decodeConfirmLinkResult(await exec('auth.email.confirm_link', codec.encodeEmailConfirmLink(token)));